---
id: CVE-2026-20218
title: >-
  Cisco Secure Firewall Threat Defense Snort 3 Visual Basic for Applications
  Buffer Overflow Denial of Service Vulnerability
summary: >-
  A vulnerability in the Snort 3 Visual Basic for Applications (VBA)
  Decompression Engine of multiple Cisco products could allow an
  unauthenticated, remote attacker to cause the Snort 3 Detection Engine to
  restart unexpectedly, resulting i…
severity: medium
cvss: 5.8
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:L'
cvssSource: cna
cwe:
  - CWE-121
vendor: Cisco
product: Cisco Open Source Snort3
affected:
  - open_source_snort3 3.12.2.0
  - open_source_snort3 3.1.2.0
  - open_source_snort3 3.1.3.0
  - open_source_snort3 3.1.4.0
  - open_source_snort3 3.1.5.0
  - open_source_snort3 3.1.6.0
  - open_source_snort3 3.1.7.0
  - open_source_snort3 3.1.8.0
  - open_source_snort3 3.1.9.0
  - open_source_snort3 3.1.10.0
  - open_source_snort3 3.1.12.0
  - open_source_snort3 3.1.13.0
  - open_source_snort3 3.1.14.0
  - open_source_snort3 3.1.15.0
  - open_source_snort3 3.1.16.0
  - open_source_snort3 3.1.17.0
  - open_source_snort3 3.1.18.0
  - open_source_snort3 3.1.19.0
  - open_source_snort3 3.1.20.0
  - open_source_snort3 3.1.21.0
  - open_source_snort3 3.1.22.0
  - open_source_snort3 3.1.23.0
  - open_source_snort3 3.1.24.0
  - open_source_snort3 3.1.25.0
  - open_source_snort3 3.1.27.0
  - open_source_snort3 3.1.28.0
  - open_source_snort3 3.1.29.0
  - open_source_snort3 3.1.30.0
  - open_source_snort3 3.1.31.0
  - open_source_snort3 3.1.32.0
  - open_source_snort3 3.1.36.0
  - open_source_snort3 3.1.38.0
  - open_source_snort3 3.1.39.0
  - open_source_snort3 3.1.40.0
  - open_source_snort3 3.1.41.0
  - open_source_snort3 3.1.42.0
  - open_source_snort3 3.1.43.0
  - open_source_snort3 3.1.45.0
  - open_source_snort3 3.1.47.0
  - open_source_snort3 3.1.48.0
  - open_source_snort3 3.1.50.0
  - open_source_snort3 3.1.51.0
  - open_source_snort3 3.1.52.0
  - open_source_snort3 3.1.53.0
  - open_source_snort3 3.1.55.0
  - open_source_snort3 3.1.56.0
  - open_source_snort3 3.1.57.0
  - open_source_snort3 3.1.58.0
  - open_source_snort3 3.1.59.0
  - open_source_snort3 3.1.60.0
published: '2026-10-21'
updated: '2026-10-21'
sourceUpdated: '2026-10-21T16:12:38.494Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-20218'
references:
  - url: >-
      https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-snort3-vba-bufdos-jAuFdvn9
    label: cisco-sa-snort3-vba-bufdos-jAuFdvn9
tags:
  - cve.org
ingestedAt: '2026-10-21T17:07:51.306Z'
---

## Overview

A vulnerability in the Snort 3 Visual Basic for Applications (VBA) Decompression Engine of multiple Cisco products could allow an unauthenticated, remote attacker to cause the Snort 3 Detection Engine to restart unexpectedly, resulting in a denial of service (DoS) condition.

This vulnerability is due to improper range checking when Snort 3 decompresses VBA data, which is user controlled. An attacker could exploit this vulnerability by sending crafted VBA data to the Snort 3 Detection Engine of a targeted device. A successful exploit could allow the attacker to cause an overflow of stack data, which could result in a DoS condition.

## Affected

- `open_source_snort3 3.12.2.0`
- `open_source_snort3 3.1.2.0`
- `open_source_snort3 3.1.3.0`
- `open_source_snort3 3.1.4.0`
- `open_source_snort3 3.1.5.0`
- `open_source_snort3 3.1.6.0`
- `open_source_snort3 3.1.7.0`
- `open_source_snort3 3.1.8.0`
- `open_source_snort3 3.1.9.0`
- `open_source_snort3 3.1.10.0`
- `open_source_snort3 3.1.12.0`
- `open_source_snort3 3.1.13.0`
- `open_source_snort3 3.1.14.0`
- `open_source_snort3 3.1.15.0`
- `open_source_snort3 3.1.16.0`
- `open_source_snort3 3.1.17.0`
- `open_source_snort3 3.1.18.0`
- `open_source_snort3 3.1.19.0`
- `open_source_snort3 3.1.20.0`
- `open_source_snort3 3.1.21.0`
- `open_source_snort3 3.1.22.0`
- `open_source_snort3 3.1.23.0`
- `open_source_snort3 3.1.24.0`
- `open_source_snort3 3.1.25.0`
- `open_source_snort3 3.1.27.0`
- `open_source_snort3 3.1.28.0`
- `open_source_snort3 3.1.29.0`
- `open_source_snort3 3.1.30.0`
- `open_source_snort3 3.1.31.0`
- `open_source_snort3 3.1.32.0`
- `open_source_snort3 3.1.36.0`
- `open_source_snort3 3.1.38.0`
- `open_source_snort3 3.1.39.0`
- `open_source_snort3 3.1.40.0`
- `open_source_snort3 3.1.41.0`
- `open_source_snort3 3.1.42.0`
- `open_source_snort3 3.1.43.0`
- `open_source_snort3 3.1.45.0`
- `open_source_snort3 3.1.47.0`
- `open_source_snort3 3.1.48.0`
- `open_source_snort3 3.1.50.0`
- `open_source_snort3 3.1.51.0`
- `open_source_snort3 3.1.52.0`
- `open_source_snort3 3.1.53.0`
- `open_source_snort3 3.1.55.0`
- `open_source_snort3 3.1.56.0`
- `open_source_snort3 3.1.57.0`
- `open_source_snort3 3.1.58.0`
- `open_source_snort3 3.1.59.0`
- `open_source_snort3 3.1.60.0`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.